|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |
Date: Thu, 13 Nov 2003 12:59:30 -0500 From: Jared Mauch <jared@puck.nether.net> To: sgorman1@gmu.edu Cc: Joel Jaeggli <joelja@darkwing.uoregon.edu>, nanog@merit.edu In-Reply-To: <1f0b6b1f2882.1f28821f0b6b@gmu.edu> Errors-To: owner-nanog-outgoing@merit.edu On Thu, Nov 13, 2003 at 10:58:38AM -0500, sgorman1@gmu.edu wrote: > > > Good point - then what is the cost of attempting to mitigate or handle attacks vs. doing nothing? > I've found that they're usually higher than doing nothing at all. In the case of the fun in august, people who blocked the microsoft ports that worms were spreading across (i mean newly blocked them that is) saw increased support costs associated with what was broken vs just leaving the network in the state it was. While the increased traffic and infection was a problem, the network devices mostly yawned at the activity and the irate customers who were (ab)using the network to use these MS RPC features were quite vocal about the filtering. This also helped raise customer awareness that we can not filter for them. They must manage their devices in order to keep their network secure or get cut off from our network. - Jared (how i wish microsoft would release a stinking patch CD) -- Jared Mauch | pgp key available via finger from jared@puck.nether.net clue++; | http://puck.nether.net/~jared/ My statements are only mine.
|
|
|
|
|
|
|
|
|
|
|
|
| home | help | back | first | fref | pref | prev | next | nref | lref | last | post |